While the government had reason to cheer the Supreme Court verdict, there is uncertainty and anxiety in the nascent digital eco-system building around the Aadhaar digital infrastructure.
Beyond the declared purpose for targeted welfare/subsidy delivery, Aadhaar has grown as a digital infrastructure created by the government that served as a platform for creating a host of authentication-based services for the private sector.
Also Read | Supreme Court gives Aadhaar some privacy
This was made possible by Section 57 of the Act, which provided any “body corporate” to use Aadhaar authentication pursuant to “any contract” between companies and individuals. In fact, these provisions have been leveraged by private players in banking services, telecom service providers and digital payment banks for smooth customer acquisition through Aadhaar authentication.
“We read down this provision to mean that such a purpose has to be backed by law. Further, whenever any such ‘law’ is made, it would be subject to judicial scrutiny,” the court’s majority judgment said effectively stopping private services from using Aadhaar authentication.
That assumes significance given the scale of the indigenously developed digital infrastructure platform so far.
Full Text | Supreme Court Aadhaar judgment
For example, as per latest figures on the Aadhaar dashboard, over 2,328 crore authentications have been carried out by the platform so far. Aadhaar launched e-KYC, (electronic Know Your Customer) services – first of its kind service on any public platform – in 2013. This service which made KYC instantaneous, secure and paperless, has grown rapidly — in five years, the Aadhaar platform provided over 641 crore e-KYC transactions at reduced cost for various government and private channels.
Anxiety among digital stakeholders which have built applications and services on Aadhaar platform is not lost to the UIDAI. Sources said that UIDAI will explore options to “minimise the blow” to the digital ecosystem around it.
Sources, in this context, referred to “offline authentication” as one way out — a facility window opened by the UIDAI in April this year. “Offline authentications does not involve the requesting entity reaching out to the Central Identities Data Repository. So it may not fall foul of the Supreme Court ruling,” said a source.
The current offline verification method allows Aadhaar holders to download a document from the UIDAI website with his/her photograph and QR code to present it to requesting entities for authentication. This digitally signed document does not include the Aadhaar number nor biometric data.
This can be an effective solution, said a source, but will require the presence of the Aadhaar holder unlike in the current ecosystem where authentication can happen remotely through eKYC.
Cellular Operators Association of India (COAI) Director General Rajan Mathews was not convinced that this method will work for operators and stressed on the foolproof authentications that Aadhaar provided.
“What happens if you turn up with someone else’s QR code? How will I know whether it is you or somebody else?” he said. “All the QR code does is mask the Aadhaar number… you are still required to authenticate by virtue of a thumbprint.”
Mathews said this ruling will impact ease of doing business and said that the Government and industry need to work out other ways to authenticate citizens, including digital signatures.
Welcoming the ruling, UIDAI CEO Ajay Bhushan Pandey was cautious about spelling out next steps. Saying that “private use should only be possible when it is sanctioned by law,” Pandey said the Authority will proceed “carefully” on how to deal with the changed circumnstances.
“We have to very carefully do this,” he said when asked if UIDAI will introduce new legislation. “Today, it is very premature to say (anything).” Pandey added that the Authority needs to discuss how to handle data already collected by private parties.